diff --git a/playbooks/core_services.yml b/playbooks/core_services.yml
index 60fa95c..351cb30 100644
--- a/playbooks/core_services.yml
+++ b/playbooks/core_services.yml
@@ -16,18 +16,8 @@
       - python3-acme
       - python3-zipp
       - python3-pyOpenSSL
-    # 2.1 Configure Server Services
-    # These services are required by FreeIPA.
-    rhel9cis_autofs_services: true  # TODO: can we mask it? This is required by FreeIPA but we don't use it.
     rhel9cis_dns_server: true
     rhel9cis_httpd_server: true
-    # 2.2 Configure Client Services
-    # These services are required by FreeIPA.
-    rhel9cis_openldap_clients_required: true
-    # 5.3.2 Configure authselect
-    # ipaservers are part of Linux Identity Management. Joining your host to an IdM
-    # domain automatically configures SSSD authentication on your host.
-    rhel9cis_allow_authselect_updates: false
     # TODO: Restricted umask breaks FreeIPA roles
     rhel9cis_rule_5_4_2_6: false
     rhel9cis_rule_5_4_3_3: false
@@ -41,16 +31,6 @@
   hosts:
     - keycloak
   become: true
-  vars:
-    rhel9cis_autofs_services: true  # TODO: can we mask it? This is required by FreeIPA but we don't use it.
-    # 2.2 Configure Client Services
-    # These services are required by FreeIPA.
-    rhel9cis_openldap_clients_required: true
-    # 5.3.2 Configure authselect
-    # ipaservers are part of Linux Identity Management. Joining your host to an IdM
-    # domain automatically configures SSSD authentication on your host.
-    rhel9cis_allow_authselect_updates: false
-    podman_host_rootless_users: ["identity"]
   roles:
     - role: sr2c.core.baseline
       tags: bootstrap
diff --git a/roles/baseline/tasks/lockdown.yml b/roles/baseline/tasks/lockdown.yml
index 9a11528..5ddbc22 100644
--- a/roles/baseline/tasks/lockdown.yml
+++ b/roles/baseline/tasks/lockdown.yml
@@ -22,4 +22,12 @@
     rhel9cis_syslog: rsyslog
     rhel9cis_time_synchronization_servers: "{{ baseline_ntp_servers }}"
     rhel9cis_warning_banner: "{{ baseline_warning_banner }}"
+    rhel9cis_autofs_services: true  # TODO: can we mask it? This is required by FreeIPA but we don't use it.
+    # 2.2 Configure Client Services
+    # These services are required by FreeIPA.
+    rhel9cis_openldap_clients_required: true
+    # 5.3.2 Configure authselect
+    # ipaservers are part of Linux Identity Management. Joining your host to an IdM
+    # domain automatically configures SSSD authentication on your host.
+    rhel9cis_allow_authselect_updates: false
   when: (ansible_distribution == "Rocky") and (ansible_distribution_major_version == "9")